CVE-2016-8507

Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initiate facetime-call without user's approval and obtain video and audio data from a device via a crafted web site.

Score

CVSS 3.1 6.5 Medium

Status

Modified - browser-security@yandex-team.ru

Published

2017-03-01

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Yandex Browser (Yandex)
• Yandex Browser For Ios (Yandex N.v.)

References

• http://www.securityfocus.com/bid/96517
• https://yandex.com/blog/security-changelogs/fixed-in-version-16-10